Medium
CVE-2024-9213
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2024-9940
Calculated Fields Form <= 5.2.45 - HTML Injection
High
CVE-2024-9215
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.7.1 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary User Email Update and Account Takeover
Medium
CVE-2024-7417
Royal Elementor Addons and Templates <= 1.3.986 - Authenticated (Subscriber+) Private Post Disclosure
Medium
CVE-2024-9934
Wp-ImageZoom <= 1.1.0 - Reflected Cross-Site Scripting
Medium
CVE-2024-8719
Flexmls® IDX Plugin <= 3.14.22 - Reflected Cross-Site Scripting
Critical
CVE-2024-9862
Miniorange OTP Verification with Firebase <= 3.6.0 - Unauthenticated Arbitrary User Password Change
Medium
CVE-2024-9351
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Quiz Creation
Medium
CVE-2024-9347
The Ultimate WordPress Toolkit – WP Extended <= 3.0.9 - Reflected Cross-Site Scripting
Medium
CVE-2024-9352
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Custom Form Creation
Critical
CVE-2024-9263
WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin <= 1.0.25 - Insecure Direct Object Reference to Unauthenticated Arbitrary User Password/Email Reset/Account Takeover
Medium
CVE-2024-9951
Wordpress Photo Album Plus <= 8.8.05.003 - Reflected Cross-Site Scripting
High
CVE-2024-9861
Miniorange OTP Verification with Firebase <= 3.6.0 - Authentication Bypass
Medium
CVE-2024-8921
Zita Elementor Site Library <= 1.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Medium
CVE-2024-9444
ElementsReady Addons for Elementor <= 6.4.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Low
CVE-2024-9506
ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function
High
CVE-2024-47824
Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room
High
CVE-2024-47080
Matrix JavaScript SDK's key history sharing could share keys to malicious devices
Critical
CVE-2024-48914
Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy
Medium
CVE-2024-48913
Hono allows bypass of CSRF Middleware by a request without Content-Type header.
Medium
CVE-2024-9937
Woo Manage Fraud Orders <= 2.6.1 - Reflected Cross-Site Scripting
Low
CVE-2024-48948
Valid ECDSA signatures erroneously rejected in Elliptic
High
CVE-2024-47876
SAK-50571 Sakai Kernel users created with type roleview can login as a normal user
Medium
CVE-2024-8541
Discount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons <= 2.6.5 - Reflected Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.